Article 3 GDPR
Territorial scope

1. This Regulation applies to the processing of personal data in connection with activities carried out by an organizational unit of the controller or processor in the Union, regardless of whether the processing takes place in the Union.

2. This Regulation applies to the processing of personal data of data subjects residing in the Union by a controller or processor without organizational units in the Union, if the processing activities involve:

(a) offering goods or services to data subjects in the Union whether or not they are required to pay;

(b) or by monitoring their behaviour where such behaviour occurs in the Union.

3. This Regulation applies to the processing of personal data by a controller that does not have an organizational unit in the Union, but has an organizational unit in a place where the law of a Member State is applicable under public international law.